Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 18:57
General
-
Target
2024-09-26_852002491b7019a7547123c6e1a25e95_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
852002491b7019a7547123c6e1a25e95
-
SHA1
5282a0a78356d39cb531aafad9b395b90198b3d1
-
SHA256
e272cfe6a25880fd96790bd008d1d3ace323f8500d132ffdcf72edd176380d8b
-
SHA512
24617c67830ea048fabb1d0b93ff2b7a20d70808cfc3c307d94dec1df63271d1273c81372541566ea1bd480d05cf3b8fac0314c7090cd65abebad0750f1dd5bd
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_852002491b7019a7547123c6e1a25e95_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_852002491b7019a7547123c6e1a25e95_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ANPBLrP.exeC:\Windows\System\ANPBLrP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwRiApm.exeC:\Windows\System\BwRiApm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASIYZwN.exeC:\Windows\System\ASIYZwN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\arvfUBp.exeC:\Windows\System\arvfUBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MygOdAm.exeC:\Windows\System\MygOdAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qAXLJSM.exeC:\Windows\System\qAXLJSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QdmgJXx.exeC:\Windows\System\QdmgJXx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zagdyno.exeC:\Windows\System\Zagdyno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zKbsxhJ.exeC:\Windows\System\zKbsxhJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UBLYktw.exeC:\Windows\System\UBLYktw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mzHIBAs.exeC:\Windows\System\mzHIBAs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QOMGIux.exeC:\Windows\System\QOMGIux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ocGsRPJ.exeC:\Windows\System\ocGsRPJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HEXaSyu.exeC:\Windows\System\HEXaSyu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcnFSwf.exeC:\Windows\System\PcnFSwf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kFvyLxs.exeC:\Windows\System\kFvyLxs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ipDLBSn.exeC:\Windows\System\ipDLBSn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jieYuUg.exeC:\Windows\System\jieYuUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPuPswL.exeC:\Windows\System\TPuPswL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kZigMKU.exeC:\Windows\System\kZigMKU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cDDBBPO.exeC:\Windows\System\cDDBBPO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD53808d6e5316f712c0d0dad441f832d8f
SHA14458b8c8e6df4aa3508df33500c9ad7949d42605
SHA256cfe16c9529177213e8363cbe2f6cbe630382b539ef54f7bb33377e09cf1dbdf5
SHA512f184650159fb0b9c0755495c1ea20d9d0df11b82c28af8b7b8ba9c066f527101400fd7a93b1efb3593904db83ddbd28dfa8145cdc94e3174f143deb017587530
-
Filesize
5.9MB
MD545fd0c26acee3a7742f4cc57dacf724b
SHA16844dd1267fb011df43800b71a663010d290bdde
SHA25613d40528c6a3c7087e9ac5d21091489139de656950294a14692f522038563bf5
SHA512a0ec0d2d715068a3f1ec12d344a580735e4db518c16b264b6d039fac0bd7fda69013761022a79171747d9461f8120b7b3efafc9b2b9c5cd6f4206e4eaf66db49
-
Filesize
5.9MB
MD5ea532208634695b2bbff01aff200d1dd
SHA180428e743e8b033ea99e2a39ddb7f576ca6c7d1d
SHA2569c852996c4141c575c72f90145e077c95ef28876244803fcfe46a5b7f7695053
SHA5128b12a7a92cb987de7acf92b4a591e59f905a7b3dadf45419748807c51f75dde58fc8a98ef02ff8822dae33990b81bafd5b30d48b2e44bb9c71cf10a0d31704b9
-
Filesize
5.9MB
MD50281e50484b4fe423c77c52364226edd
SHA1980ea93eae36634682e86f1e39b61080fca18085
SHA25605602387c33c18ff43c03d996181e872123189d16163ec19a49bd3cd189db8ff
SHA5126099f7d95a82d4d1ab81f2c109d66719f9697e874dce5445c4c9ff930ac72f2325e8b0ef3ad1e9dacc9a6e3eba1292211c4c05e13bbde9052d563087c272495d
-
Filesize
5.9MB
MD57aca2adfafd08d9e48a5da5afc72717f
SHA1862a77112078a81e1d70bf871eb1940f97b8c66d
SHA2560a14c305ee3e868b615d8d5d8eb072ff4ea94128fcbc65f6296543d46a69892e
SHA5122bb6267d1aca5a9da39a97d7468b9041c400772f7a389e8eed08995731872c0413240eab2de9c0e9ea674d3b33cedcf2c9044abc305485c8589ad6644a419114
-
Filesize
5.9MB
MD5ae4ba7babbd4403a6584c66423666408
SHA1b048ef0eebbc054bdb1f6344c15c1c8e937aecad
SHA256e973b6447972f531a934fd4b566b02a516a8a4f4db46b7c1a86c152656832f01
SHA51202b2cf16aba696d6f775eb09e7c0c7ee3ef557f66096b59d669bf2e4e04af68aa77bb6be4260629ca08fb9e9172e51b9124eb53db79535a26ec212758aca9f3b
-
Filesize
5.9MB
MD564c4f1849e7d2c24b4209835c971e0f0
SHA1adc374db5d47929bb614a16685736ae6315cdf4c
SHA256eb4eff5135f45f83f24ef27c495aed68b677545bfd7008047d70fb7a9989e764
SHA5120c24498195eca5f9ae778affaf2b2e8fa819c4f8366426af32508ac0dc9691632ee72773cb4eb15293e4e31aec581ba5667f2dc12548ca5167665653c32619e7
-
Filesize
5.9MB
MD5ea6f3e0c2f8c75a4809201902fad3f28
SHA17ed32b48c16dfa72941f0623b6cdd70781c57303
SHA256eed02085cc403088d6dd56c6a3fc0fff93e471c9d668a1383930115c77f79428
SHA5122bbdb7495f8ca6de7bed1530e4a9cb39401093eef24bf7c0b3823c64727fb61a76578aaa6dcdfff2da07e7cddf790401650c794bc7158aa06d65c774132d5d40
-
Filesize
5.9MB
MD596cd502bde010f6a91a86812dd15f05e
SHA114e8ef8a9e46ab34ab35480af721afb2ae4fd1d8
SHA2568be5feb1dbb341a1b6015bcabd77e67db9cfda9361cb931f10bc38c298e0d2a6
SHA5120fb766f9532413ab4bf3822f52076f7f2e79c76cb8208e2c5626146e8df6c57f26b0e00ebd12437c863b86b3ac0b7457ecc41f85d549f8f683c48d5f56d99460
-
Filesize
5.9MB
MD5ce1ea207ba76a3e3a4abe527073197d0
SHA145532c41360a6263f946a952615b869491f878e9
SHA25648d78cfd77241a373270a6221641f9a2edde1ac60ec3da65682a5908d1b22b90
SHA51260e3020c6246c85c70b908a5d42975eb3f0abcf17c48ea8e08138ccc699775300904f3b50deee5e04e381f607bb83f275243ccfd22c6c67d92fddad91ccc8c15
-
Filesize
5.9MB
MD57f4bb4e3173465964f9ff6ceff38f159
SHA11fd204c8c9fc891694f3b46f1ede4d96b7d5d005
SHA256be76e39b87b325836c503c87ecb0449e07a4866f602c80e512baff03d5d5add6
SHA51251dfe3a1c81e259b67b6c24063dbbb3b8041dba1c337ae07374a5da16d2e85c50532b84d6adf26f6ed8e187aa67efdef1445612f8cf8f6e5e3f771f79be8307d
-
Filesize
5.9MB
MD53e213ae6a9ad59903b3004f4d4da98c1
SHA104588fcd1ee988f763dc84f564d1042f6e203980
SHA256f26139972044adf61c9dc8d948c525aa1a57d1c43e4f825d58a626bb46d75302
SHA51263dc83c5aed9629cceff24347fff41b8e27344a76deb265ead43de98a85da228b5724fa386aa394c8dfd4687d3665fbfa3e9ad8fcce8d7b35c86825a0033a971
-
Filesize
5.9MB
MD580c8771c38bdb2dc4b0091217a9ad2c8
SHA103aee0fb025450470e576e313735d15cb11a7475
SHA2568e94bfac68c2a98aa86a8f710ef84534a721b3569754bc264566b38a7896e5f3
SHA512d32fdc8b698da6737febd3e48cb7d5cad8cbe394a92b27ecc4c0202a5a19e3462210ca6ae0de11a63a740fa30b9024d8ebae3ffd4f315c6f73d8297318f48907
-
Filesize
5.9MB
MD5e6e6be3e3061400e1b4a8189601a4d85
SHA1821934c687e38d4f9b03cd4a21492c09550a6fdd
SHA256f23e0770d62eede12ca3e45b1b110afc6f5e39546b2e309d155c381117bf5ff4
SHA5123066d83e384f35ed9d26f1f69d81dd64063512021a5a846d653c0f60ec58c0f3f8351286d5eb3310e0e3112151521f50743309e8f3e7aac172ab7a146413f63f
-
Filesize
5.9MB
MD58ce5572b7dbd1a671f2b543badfab7a5
SHA18570eb43ca741bf109aeba17a20a745fe5a45a2b
SHA25634f4ff8582184bc676996bfd46486f14239cec4dc786783c4864b5ce59fd6074
SHA5120afe22df6c6f8e8fa330d4b1eaa54ad60b302c4d1113a19ddb8125159b1173bd396834082e028f28d754e4d8b2f866e9df698f64a8c42791d29512bcb3e8b86f
-
Filesize
5.9MB
MD558f924a7ec353f3b8950ac9d408dbc33
SHA1c5a40737a8153eb776fec681a1ae9a1ec4da4fe8
SHA25626e74b154d016371e351e5df2ac59cc411858f63afa56b08aa1fd977968559e7
SHA512ef5f50b8492dfa9480edbfc77b3da2deb24ba70e58a635ef31f275d546b72e78108ad88952f21daf159eff035cfa83959cc50f7507bf9a5ada1c7ebd4de8acdd
-
Filesize
5.9MB
MD5b50211da3b0826d55947436ae7345008
SHA131878ae5d21dd6a8aa5637dcd65893a3bf6a7496
SHA2569e1121c9a9ce9d04ce2fbd7d82a1e87a8d013d29aa2b8db443a35b63ed208523
SHA51204fead5b35e0983d4cff2ad96a604d3814405d0f230fd5b8f126ac1812ee075a65703a724b537a036b8a577a1d963a47368e5949efd3963f061e34d9fdab1b47
-
Filesize
5.9MB
MD51b8b8747d94fcb363ab7cdf7f35091c1
SHA17e0b94be8d1d699ad7f554a9a71d2f29d716572e
SHA2568c5227a164235770452ded0b0833fcea51bfd6d6a74aa7ff70f2b9efd4e499f2
SHA512cdb0d58ad87b4ef28eba022cdbcae6f2d83efee937d0a89aa877655bf5f17579186711b25890aee8aa1bcc9c625f1feeec2ad2a34f0ffa6b01e913db89b1a6ba
-
Filesize
5.9MB
MD5f694d0c9b2024472f65ae4b48ca50fdb
SHA1ccac2bef78ae5d78da6042a07e43746269916746
SHA2567a915e5dfe9cea9aff1f386d47eada40b0f2e1957334e8afafc92de9431d2612
SHA5120b66a24db8e9d43a134bb2b6cbe1a08ba514ea2db941b0dc8010b72511a297dae72492392df495d36cd82484d69d85cfe61218f4ca117f339b8a868acdd8232e
-
Filesize
5.9MB
MD5b3cffe50c0ee26244046c67fab0ada80
SHA14143b8ebb54bd35bfc8faa70c5c5da06d15da32e
SHA256c1b3754af443843fb3434d8a4ed1bd0d3a0bd10d405a89f090a06cb10aa818c9
SHA5121ed0240c20e408004ef84e012e6473a03cc659ab9f5d97a2a4d18f9bbbee408ecfd2c17b81824b6d10408afde2b3256e91a0fbd0dccc70d4568ff29dcd8768e5
-
Filesize
5.9MB
MD5d783e0d9c7c207db693cabd34ecaf0ad
SHA1e9370605d1d0f7a2b0f1f439edbaa2f2e32f11a2
SHA2564ea072927bcb3ee590380bbb906bbe668cea2b3e6752055bbc3b63ba8fda45cb
SHA512b119030e15b9c4cd47d46e8f3a127bf30dc3617ec2854c27fe715af67e694636fb73b3380cbae813c474097be69b9d821d0d5fde03348bd6a0392bdaf4cd5946
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB